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Grover's operator in the two-qubit case can transform a basis into its conjugated basis. A permu- 
tation operator can transform a state in the two conjugated bases into its orthogonal state. These 
properties are included in a threshold quantum protocol. The proposed threshold quantum proto- 
col is secure based the proof that the legitimate participators can only eavesdrop 2 bits of 3 bits 
operation information on one two-qubit with error probability 3/8. We propose a scheme to detect 
the Trojan horse attack without destroying the legal qubit. 

PACS numbers: 03.67.Dd, 03.65.Ud 



I. INTRODUCTION 

In a secure multi-party computation P, Q , partici- 
pants. Pi, P2, ■■■Pn, compute and reveal the result of the 
multi-variable function f(xi,X2, ■■■Xn), where Xi is a se- 
cret input provided by Pi . It is also necessary to preserve 
the maximum privacy of each input Xi . The menace of in- 
put leakage comes from eavesdroppers and the dishonest 
participants. In contrast to the eavesdroppers outside, 
the dishonest participants have many advantages to at- 
tack another's input. As pointed out in Ref. 3], if multi- 
party scheme is secure for the dishonest participants, it 
is secure for any eavesdropper. 

Based on the operators / = ^ ^ 
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cure direct communication (QSDC) protocols 0, |E @j 
multiparty quantum secret sharing (MOSS) protocols 
0, 0, 13 Etnd threshold quantum protocol 'lO^ have been 
proposed. Lucamarini and Mancini 6J showed that the 
QSDC protocols are quasisecure to eavesdropper. 

Deng et al.Q showed a Trojan horse attack scheme 
against MQSS protocol proposed by Ref. 7]. A dishon- 
est participant prepares a multi-photon instead of a legal 
single-photon and sends it to another participant. Then 
he measures the photons with some photon number split- 
ter (PNS) and detectors. The attack introduces no error 
into the communication. 

Qin et al.0 showed another attack scheme against 
MQSS protocol proposed by Ref.Q- A dishonest par- 
ticipant prepares the fake state (|01)i2 — |10)i2)/\/2 
and then sends the first qubit to another participant. 
After receiving the first qubit operated, the dishon- 
est participant can know another participant's opera- 
tion I,U,H or H by measuring qubits 1,2 in the basis 
{(101) - m)/V2, (100) + |11))/V2, (100) - 101) - |10) - 
|11))/2,(|00) + |01) + |10) - |ll))/2}. The attack also 
introduces no error into the communication. 

Participants can pick out a subset of the photons as the 



sample for eavesdropping check. Deng et aLQ proposed 
that participants split each signal of the sample with a 
PNS and measure the two signals. Qin et al.Q proposed 
that participants replace the sample photons with decoy 
photons. 

In a threshold quantum cryptography, assumption that 
all the participants are honest is infeasible. The t-out- 
of-n quantum cash threshold protocol proposed by Toku- 
naga et al._10] is not secure. With the help of the attack 
schemes proposed in Ref. 0, ||| , the first participant Pi , 
called a center in Ref. j can completely eavesdrop t—1 
secret inputs kept by t— 1 other participants in a issuing 
phase one by one, and then reconstructs the copies of 
quantum cash that can pass the checking phase. 

The sample photons schemes |^ can improve the se- 
curity of the threshold quantum protocol [l3|- However 
the number of qubits of the generated quantum state by 
the threshold protocol must exceed that of the quantum 
state generated by the original (nonthreshold) protocol. 
We do not follow this line of argument. Instead we mod- 
ify the protocol in the two-qubit quantum operation. 

A quantum computation consists of three constituents: 
generating quantum states, performing unitary opera- 
tions and measuring quantum states. The dishonest par- 
ticipants whose number is less than threshold number 
can generate the fake quantum states or perform the fake 
unitary operations to attack one other's input, but before 
measurement, they must reconstruct the legal quantum 
state to avoid the detection. In this paper, a honest mea- 
surer is assumed . 

In this paper, instead of one-qubit operators, we show 
that two-qubit operators based on Grovers algorithm 
[III can adapt to threshold quantum cryptography 
protocol. Each participant does one of eight kinds of 
operations on every two-qubit as input. The dishon- 
est participants can eavesdrop 2 bits of 3 bits opera- 
tion information on one two-qubit at most with whether 
fake signal or legal signal. The dishonest participants 
have to introduce | error probability into one two-qubit 
when they eavesdrop maximum information quantity 2 
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bits. These properties guarantee the proposed threshold 
quantum protocol against an attack with a fake signal. 
Moreover, since even the three-qubit Grover's algorithm 
has been experimentally realized 'iS'l , threshold quantum 
cryptography protocol based on Grover's algorithm be- 
comes highly practical for experimental realization. 

In this paper, we propose a detection scheme to dis- 
tinguish one single-qubit from one multi-qubit without 
destroying the legal qubit. The scheme can detect one 
multi-qubit instead of one single-qubit with probability 
^. So a Trojan horse attack can be resisted. 

This paper is organized as follows. Section II intro- 
duces two-qubit operators based on Grovers algorithm 
[Tll |. Section III proposes an t-out-of-n quantum cash 
threshold protocol followed the line sketched in 10] but 
with some relevant differences. Section IV then shows 
security of the threshold protocol. Section V proofs that 
Trojan horse attack can be detected. Section VI then 
draws some conclusions. 



II. TWO-QUBIT OPERATIONS BASED ON 
GROVER'S ALGORITHM 

Grover's operator in the two-qubit case 
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(1) 



can transform the basis {|00), |01), |10) and |11)} to the 
basis {|00> = l/2(-|00) + |01_>_+ |10> + |11)), |0T) ^ 
1/2(100) - |01) + m + 111)), |10) = 1/2(100) + |01> - 
|10) + 111)) and 111) = 1/2(|00) + |01) + |10) - |11))}. 
A permutation operator 
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has properties: /7|00) =J01), C/|01) = |10), [/[lO) = |11), 

u\\\) Hoo),^|oo) = |oi), c/|oi) = |io), um = 111), 

and C/|ll) = |00). V and U are commute operators. 

In the threshold quantum proposed below, a center 
docs one of eight kinds unitary operation on two-qubit: 

f/(00)F(0) = /, 
U{Ql)V{Q) = U, 
U{10)V{0) ^U-U, 
U{11)V{0) -U -U, 
U{00)V{1) = V, 
U{01)V{1) -v, 
U{IQ)V{1) = U-U-V, 

u{n)vii) ^u-u-u-v, 

where / is identity operator. 



III. T-OUT-N THRESHOLD SCHEME 

We propose the t-out-of-n threshold version of quan- 
tum cash protocol. There are three differences between 
our protocol and the protocol proposed by Tokunaga et 
al. 10| mainly: one is the assumption of dishonest par- 
ticipants instead of that of honest participants, one is 
two-qubit operation instead of one-qubit operation to re- 
sist the attack proposed by , the other is an additional 
detection to resist the Trojan horse attack [1,Q|. Fol- 
lowing the line sketched in ^3|j We describe the scheme 
in detail. 

Distribution phase. In this phase, a dealer distributes 
shared secrets to centers. 

(i) A dealer chooses an original secret 



K = (fli, 5i, a2, 62, a,n, b,n) 



(3) 



for each banknote with Lk, where Lk is a kind of serial 
number (used as a label for K) and a^, bi are uniformly 
chosen, at e {00, 01, 10, 11}, b, e {0, 1} 

(ii) The dealer then makes n shares , 5*1 Sn, of K 

using Shamir's secret sharing scheme [13 over F2N as 
follows, where N = 3m. The dealer chooses Xj's for 
j = l,...,n which are n distinct, nonzero elements in 
F2N, and the Xj^s are published with Lk- The dealer 
randomly chooses a secret (t — l)th-degree polynomial 
f{x) over F2iv, where /(O) = K (here, K is a polynomial 
representation of K). Then, the dealer computes 5*^ = 
f{xj) for j=l,...,n over F2N. 

(iii) The dealer secretly sends Sj with Lk to center Pj 
for each j = 1, n. 

Precomputation phase. In this phase, the centers com- 
pute the preliminary information for the following col- 
laborative procedure. The preliminary information de- 
pends on which subset of centers is chosen to collaborate. 
Here, for simplicity of description, we assume that t cen- 
ters, Pi,...,Pt, collaborate to issue quantum banknotes 
or check their validity. Note that the set of collaborative 
centers can be different in each issuing or checking phase. 

(i) For each j = l,...,t, Pj calculates and secretly 
stores the following value (given by the Lagrange inter- 
polation formula): 
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over F9 



Let 



K^^ = {af,bi 



m u[o\ M Aj] 



(4) 



(5) 



be the binary representation of Kj in F2iv, where a " G 

{00,01, 10, 11}, e {0, 1}. Although each secret value 
Sj (and Kj) is kept in each center Pj locally, these values 
satisfy the following equations globally: 



K 



(6) 
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over . In binary representation, Eq. ^ can be written where 



as 



K = ®*K^^^ 



(7) 



where © represents bitwise exclusive-OR. Note that even 
in the following collaboration procedure, Kj{K^^^) is kept 
secret at Pj and the original secret K{K^^^) is not recov- 
ered. 

Issuing phase. In this phase, t centers collaborate to 
issue a banknote {Lk, \(t>))- Here, we assume the t centers 
are Pi,...,Pt. Hereafter, we will describe a sequential 
protocol from Pi to Pt, but the order is not essential, 
any order is possible. 

(i) Pi generates a quantum state 

= IV^^iu (E> l^^iu ® ... |V'„iii .w), (8) 



where \ip^ii] f^ii]) is defined as follow: 

|0oo,o) = mA^ouo) = |01), 
|0io,o) = |10),|(/)n,o) - 111), 
l-^oo,!) = |OO),|0oi,i) = |0T), 
|(/.io,i) = |TO),|0ii,i) = |n). 



(9) 



The value of bi determines the kind of the basis. If bi is 
then Ui is encoded in the basis {|00), |01), |10), |11)}; if bi 
is 1 then at is encoded in the basis {|00), |01), |10), |11)}. 
The {Lk, If/iW)) is sent to P2. 

(ii) For each j — 2,...,t, when Pj receives 
{Lk, I*^'''""'^')) from Pj-i, he detects the Trojan horse at- 
tack and acts his secret input on j^I-'"^!). 

Our detection scheme is depicted in Fig. 1. To each 
qubit Id) of called data qubit, Pj uniformly 

choices auxiliary qubit \a) G {|0),|1)}, acts Hadamard 
gate on |a), performs one CNOT gates on the auxiliary 
qubit and the data qubit (the former is the controller and 
the latter is the target), performs the unitary transfor- 
mation 



V2 



/ 1 1 

oil 

10 0-1 

Vo 1 -1 



(10) 



on the auxiliary qubit and the data qubit, and measures 
the auxiliary qubit in basis {|0), |1)}. To legal single 
qubit \d), Tad ■ CNOTad ■ {Ha ® Id) ^ la® Id, so the 
auxiliary qubit keeps. In Section V, we proof that the 
detection scheme can detect a multi-qubit instead of a 
single-qubit with probability i. If the auxiliary qubit 
flips, a single-qubit must be replaced by a multi-qubit, 
so Pj rejects the banknote. 

Pj applies the following transformation W^^^ to 



(12) 



Pj then obtains l^'-'l) by the unitary transformation 



(13) 



and sends {Lk, I'/''"'')) to Pj+i {Pt+i is the user whom the 
banknote is issued to ). 

Checking phase. In this phase, t centers collaborate 
to check the validity of quantum banknote {Lk, 10')). 
Here, we assume the t centers are P{, . . . , P/. This set of 
t centers can be different from the set of centers that col- 
laborate to issue the banknote. Each Pj has calculated 

ifbl' = (a[^'1^6[^1^4^1',4''l^■■•:a™^^™') ^ the precom- 
putation phase. Let \(t>^^^') — |0'), and Pq be the shop. 

(i) For each j = l,...,t, when Pj receives 
(Lk, 10'-'"^^')) from Pj_i, he detects the Trojan horse 
attack and applies W^^T' to |<?!)[^"^1') [here, IF^l' is de- 
fined in the same manner as Eqs. (|ll|l - H12(l ]. Pj then 
obtains I'/S^-'l') by the unitary transformation 



^r[3]' . I^b-l]') ^ |(^b1'). 



Additionally, P' chooses a secret 



x — V"*"! ; •''2 , ■ ■ ■ , ■^m ) 



(14) 



(15) 



where Jf' is uniformly choosen from {0,1}. Pj then 
obtains l^'-''') by the unitary transformation 

V{x^^') y(xW') : (^W) ^ |0[^'l'). (16) 

Pj sends {Lk, to P'^^^ (P/+i is the trusted mea- 

surer). 

(ii) Finally, the trusted measurer requires Pj(j = 
1, . . . , m) to send the x^"^' to him secretly, measures \4>^^'^') 
in the basis {®^j^ixf^' , . . . , ©*=ia;m'), and gets the string 

(ci,...,c„). (17) 

The trusted measurer then checks whether Ci — 00 for all 
I = 1, . . . , m. Even if just one result is not 00, the centers 
reject the banknote. 

Necessity of the trusted measurer: If {Lk, W)) 
is an invalid quantum banknote, a dishonest mea- 
surer can always deceive the centers by announcing 
(ci, . . . , c„i)=(00, . . . , 00). So an honest measurer is nec- 
essary. It is also necessary that the trusted measurer re- 
ceives the value x^"^' secretly, otherwise the center P/ can 
always send the quantum states |0'*'') = |00) ® . . .® |00) 
to deceive the trusted measurer. 



4 



auxiliary 
qubit 



data 
qubit 




FIG. 1. Detection scheme of Trojan horse attack. 



IV. SECURITY PROOF 



Bob's fake signal can be presented as |6') = |00)(a|j4) + 
b\B) + c\C) + d\D)) + |01)(e|A) + f\B) + g\C) + h\D)) + 
\lO){i\A) + j\B) + k\C) + q\D)) + \ll){m\A) + n\B) + 
r\C)+s\D)), where \ A),\B),\C), and \D) are normalized 
orthogonal states, and |ap + |6p + |cp + |dp + |ep + |/p + 

|5|2 + |/i|2 + |i|2 + |j|2 + |A:|2 + |g|2 + |„^|2 + |,j|2^|^|2^|^,|2 ^ ^ 

For simplicity, we regard every probability amplitude as 
real number, but the security proof is fitted for plural 
number. Bob sends the former two-qubit to Alice and 
leaves the rest himself. 

Alice encodes her input bit by applying one of eight 
kinds of operations with equal probability. The state 
reads 



The impossibility of Eve's eavesdropping in the thresh- 
old protocol was shown using the quantum key distribu- 
tion approach, following the line sketched in (16j . 

The eavesdropping is restricted to a dishonest partici- 
pant in the following. 

A dishonest participant, called Bob, is an evil quantum 
physicist able to build all devices that are allowed by 
the laws of quantum mechanics. Her aim is to find out 
another participant's input and then to reconstruct the 
quantum cash with t—2 other participants. Bob prepares 
a fake signal and sends it to a participant, called Alice. 
Then from the fake signal operated by the Alice, Bob 
tries to gain Alice's input. 

Without loss of generality, we assume that Alice does 
one of eight kinds of operations on every two-qubit with 
equal probability and that every two-qubit operation is 
independent. So it is sufhcient to consider Bob's eaves- 
dropping on one two-qubit. 



w = -\e){e\ + -{u®i)\e){e\{u+®i) 
+l{u ■ u T)\9){e\{U+ ■ u+ T) 

o 

+liu -u -u (E) i)\e)(e\{u+ ■u+ -u^ ®i) 

8 

+\{v ®i)\e){e\{v+ ®i) 

8 

+\{u ■ V ® i)\6){e\{v+ ■u+ ®i) 

8 

+ \{U ■ U ■ V ® I)\e) {9\ {V+ ■U+ -U+iSl) 
o 

+ 1{U-U-U ■V(E)I)\9)(e\{V+ ■U+ ■U+ ■ U+(E)I). 
8 

With the matrix form, the mixed state can be represented 
as 



/ a2 -I- e2 + ^2 + 777,2 

ab + ef + ij + m,n 
ac + eg + ik + mr 
ad + eh + iq + ms 

(a + i){e + m) 
af + ej + bm + in 
ag + ek + cm + ir 
ah + drn + eq + is 

2{ai + em) 
bi + aj + fm + en 
ci + ak + gm + er 
di + hm + aq + es 

(a + i){e + m) 
be + fi + jm + an 
ce + gi + km + ar 
\ de + hi + mq + as 



ab + ef + ij + mn 

b'^ + P+ f + 
be + fg + jk + nr 
bd + fh + jq + ns 
be + fi + jm + a77- 

{b + Mf + n) 
bg + fk + cn + jr 
bh + dn + fq + js 
bi + aj + fm + en 

2{bj + fn) 
cj + bk + gn + fr 
dj + hn + bq + fs 
o-f + sj'^ bm + in 
'{b + j){f + n) 
cf + gj + kn + br 
df + hj -\- nq-\-bs 



ac + eg + ifc + mr 
be + fg + jk + nr 
c'^ + g"^ + k'^ + r2 
cd + gh + kq + rs 
ce + gi + km + ar 
cf + gj + kn + br 

{c + k){g + r) 
ch + gq + dr + ks 
ci + ak + gm + er 
cj + bk + gn + fr 

2(ck + gr) 
dk + cq + hr + gs 
ag + ek + cm + ir 
bg + fk + cn + jr 

{c + k){g + r) 
dg + hk + qr + cs 



ad + eh + iq + ms 
bd + fh + jq + ns 
cd + gh + kq + rs 
d^ + h^ + q^ + s2 
de + hi + mq + as 
df + hj + nq + bs 
dg + hk + qr + cs 

{d + q){h + s) 
di + hm + aq + es 
dj + hn + bq + f s 
dk + cq + hr + gs 

2{dq + hs) 
ah + dm + eq + is 
bh + dn + fq + js 
ch + gq + dr + ks 

{d + q){h + s) 



(a -t- i)(e -t- m) 
be + fi + jm + an 
ce + gi + km + ar 
de + hi + mq + as 

+ e2 + ^2 + 77i2 

ab + ef + ij + mn 
ac + eg + ik + mr 
ad + eh + iq + ms 

(a -I- z)(e -t- m) 
af + ej + bm + in 
ag + ek + cm + ir 
ah + dm + eq + is 

2{ai -|- 6777) 

bi + aj -f /777 + en 
ci -\- ak + gm + er 
di -\- hm + ag + es 



1 



af ej + ^777 + in 

{b + j){f + n) 
cf + gj + kn + br 
df + hj + nq + bs 
ab + ef + ij + 77777 

62 + /2+j2^^2 

be + fg + jk + nr 
bd + fh + jq + ns 
be + fi + jm + an 

ib + j)if + n) 
bg + fk + cn + jr 
bh + dn + fq + js 
bi + aj + /777 + en 

2{bj + fn) 
cj + bk + g77 + fr 
dj + hn + bq + f s 
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nr 



ag + ek + cm, + ir 
bg + fk + cn + jr 

{c + k){g + r) 
dg + hk + qr + cs 
ac + eg + ik + mr 
be + fg + jk 
+g'^ + k'^ 
cd + gh + kq + rs 
ce + gi + km + ar 
cf + gj + kn + br 

{c + k){g + r) 
ch + gq + dr + ks 
ci + ak + gm + er 
cj + bk + gn + fr 

2{ck + gr) 
dk + cq + hr + gs 



ah + dm + eq + is 
bh + dn + fq + js 
ch + gq + dr + ks 

{d + q){h + s) 
ad + eh + iq + ms 
bd + fh + jq + ns 
cd + gh + kq + rs 



d'' + h^ + q^ + s^ 

de + hi + mq + as 
df + hj + nq + bs 
dg + hk + qr + cs 

{d + q){h + s) 
di + hm. + aq + es 
dj + hn + bq + fs 
dk + cq + hr + gs 
2{dq + hs) 



2{ai + em) 
bi + aj + fm + en 
ci + ak + gm + er 
di + hm + aq + es 

(a + i){e + m) 
be + fi + jm + an 
ce + gi + km + ar 
de + hi + mq + as 
a^ + e^ + + m^ 
ab + ef + ij + mn 
ac + eg + ik + mr 
ad + eh + iq + ms 

{a + i){e + m) 
af + ej + bm + in 
ag + ek + cm + ir 
ah + dm + eq + is 

(a + i){e + m) 
af + ej + bm + in 
ag + ek + cm + ir 
ah + dm + eq + is 

2{ai + em) 
bi + aj + fm + en 
ci + ak -\- gm + er 
di + hm + aq + es 

{a + i){e + m) 
be + fi + jm, + an 
ce + gi + km + ar 
de + hi + mq + as 
+ e^ + 1^ + m^ 
ab + ef + ij + mn 
ac + eg + ik + mr 
ad + eh + iq + ms 



bi + aj + fm + en ci + ak + gm + er 

2{bj + fn) cj + bk + gn + fr 
cj + bk + gn + fr 2{ck + gr) 

dj + hn + bq + fs dk + cq + hr + gs 

af + ej + bm + in ag + ek + cm + ir 

{b + j){f + n) bg + fk + cn + jr 
cf + gj + kn + br (c + k) {g + r) 

df + hj + nq + bs dg + hk + qr + cs 

ab + ef + ij + mn ac + eg + ik + mr 

' bc + fg + jk + nr 



d,i - 
dk 



- hm - 
h hn - 

2{dq- 



- aq + es 
bq + fs 
hr + gs 

-hs) 



b^ + f^+f+n' 
be + fg + jk + nr 

bd + fh + jq + ns 

be + fi + jm, + an 

(& + . 7 )(/ + "•) 
bg + fk + cn + jr 

bh + dn + fq + js 



c^ + g^ + k^ + r^ 
cd + gh + kq + rs 
ce + gi + km, + ar 
('f + f)j + kn + br- 
ie +k,){g+r) 
ch + gq + dr + ks 



ah + dm + eq + is 

bh + dn + fq + js 
ch + gq + dr + ks 
{d + q){h + s) 

ad + eh + iq + ms 
bd + fh + jq + ns 
cd + gh + kq + rs 
d^ + h^ + q^ + 
de + hi + mq + as 
df + hj + nq + bs 
dg + hk, + qr + cs 
{d + q){h + s) 



be + fi+ jm + an ce + gi + km + ar de + hi + mq + as\ 



{b 



n) 



J)i.f 
bg + fk + cn 
bh + dn + fq 
bi + aj + fm 

2{bj + fn) 
cj + bk + gn + fr 
dj + hn + bq + fs 



js 
en 



cf + gj + kn + br 

ic + k){g + r) 
ch + gq + dr + ks 
ci + ak + gm + er 
cj + bk + gn + fr 

2(ck + gr) 
dk + cq + hr + gs 



df + hj + nq + bs 
dg + hk, + qr + cs 

id + q){h + s) 
di + hm + aq + es 
dj + hn + bq + fs 
dk + cq + hr + gs 
2{dq + hs) 



af + ej + bm + in ag + ek + cm + ir ah + dm + eq + is 



{b + j)if + n) 
c/ + gj + kn + br 
df + hj + nq + bs 
ab + ef + ij + mn 
9 + P+j^+n^ 
be + fg + jk + nr 
bd + fh + jq + ns 



bg + fk + cn + jr 

{c + k){g + r) 
dg + hk + qr + cs 
ac + eg + ik + mr 
bc + fg + jk + nr 
c"^ +g^ + k'^ + r^ 
cd + gh + kq + rs 



bh + dn + fq + js 
ch + gq + dr + ks 

{d + q){h + s) 
ad + eh + iq + ms 
bd + fh + jq + ns 
cd + gh + kq + rs 
+ /i^ + gr^ + 



(18) 



The mutual information between Bob and Alice that can 
be extracted from this state is given by the von-Neumann 
entropy, /(Alice, Bob)< S{w) = Tr{wlog2w}. In order to 
calculate the von-Neumann entropy, we need the eigen- 
values A of w, which are the roots of the characteristic 
polynomial det(u>). Equivalently, we compute the roots 
of the characteristic polynomial det{XwX~^), yielding 
the 16 eigenvalues 



Ai,2 = J((a - 0' + ib- ] f + (c - k)' + (e - m)' 
+{f - n)2 + {d- qf + {g- r)^ + {h- s)^), 



= -((a-e + i-m)2 + (6-/ + i 



+{c- g + k-r)'^ + {d-h + q- s)^)), 
A4 = -^{{a + e + i + m)^ + {b + f + j + n)'^ 
+{{c + g + k + r)'^ + {d + h + q + s)^)), 

A5_16 = 0. 



where 



(19) 
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So we have 

I{Alice, Bob) < 
—Xilog2Xi — X2log2\2 — ^31092X3 — X4log2X4- (21) 

To Ai = A2 = A3 = A4 = I;, /(Alice,Bob) reaches the 
maximal value 2 bits. So Bob can eavesdrop 2 bits of 3 
bits operation information on one two-qubit 

Especially, /(Alice, Bob) reaches the maximal value 
when Bob prepares the legal two-qubit, namely a = 1, 
or e = 1, or i = 1, or rn = 1, or —a = e = i = m=^, 
or a = — e = i = m = ^, or a = e = — i = m = 5, or 
a = e = i = — m=|. Bob can not gain more infor- 
mation by sending a fake single than by sending a legal 
single. 

Bob's eavesdropping introduces error into quantum 
state. Bob can not gain Alice's input from the two-qubit 
operated by both Alice and her next participant. Bob 
has to measure the two-qubit to extract Alice's input 
before one two-qubit is resent. To eavesdrop 2 bits op- 
eration information, Bob gains the maximal mixed state 
i/4 through sending a legal two-qubit, or gains one max- 
imal mixed state equivalent to jl^ through sending a 
fake singal. After extracting 2 bits operation informa- 
tion from i/4, he has to introduce | error into whether 
one reconstruction two-qubit or the collapse two-qubit. 

V. TROJAN HORSE ATTACK CAN BE 
DETECTED 

A Trojan horse attack bases on the idea that we can 
precisely know an unknown quantum state by measuring 
many copies of the state. Let Bob prepare the multi- 
qubit I]jiJ2...w «ni2...i™ Ni«2 • • • «m)i,2,...m {m > 2) to re- 
place one data qubit \d). 



In the detection scheme of the Trojan horse arrack 
(Fig. 1), Alice prepares an auxiliary qubit \a) = |0) or 
|a) = |l). 

After the operation H\a), the system state is 

1^1) = "71 «iii2...i„.(|0) + |l))|ili2...im)l,2,...m 

(|a) = |0)) 

or \vi) = -7^ 0'iii2-iA\^) -\^))\ili2---im)l,2,...m 

^ ilS2---»Tn 

(l«) = |l))- 

(22) 

Here we use superscripts and 1 to denote the states 
corresponding to a = and a = 1, respectively. This 
notation also applies to the following equations and we 
will, for simplicity, suppress the word "or" later. 

Instead of the operator Cad, the operators 
Cai,Ca2, ■ ■ ■ ,Cam Sivs performed. The system state 
is 



1^2) = ^ an»2...i„(|0)|«li2 . . .im)l,2,...m 

+ \l)\hi2---im)l,2,- 
I'^s) = X] aHi2...im(|0)|H«2...«m)l,2,...m 

-|l)|ili2...ZTO)l,2,...m)- (23) 

Instead of the operator Tad, the operators 
Tai,Ta2, ■ ■ ■ ,Tam are performed. The system state 
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) = 7=ff E lo)M2...Ui,2„ 

^ il''2---*m 



E2---X„iffiJlJ2---»77 



=fT E |l)|H«2---«m)l,2,...m 
m+1 ' 



V2 



I 'y ^ |-^_-|^^r(jia;2...Xml®n j2-..imO) 



l^3) = -/=f E |0)Kl«2---im)l,2,...m 

* ili2...im 

I ^ ^ |'J'_-|^^-r(ilX2...XTO®»l»2---im) 



_j_^_]^^T(iiX2...Xm©ili2---im) + ljQ. | 

+ E |l>M2...Zn^)l,2,...,„ 

iii2---im 

I ^ ^ |"^_]^^r(zia:2-..Xml©n«2...'imO) 



where = 1, 1 = 0, and r(a;iX2 . . . x„) represents the 
number of XkXk+i = 11 (fc = 1, 2, . . . n — 1), for example, 
r(llOOlll) = 3, r(lOllOll) = 2. 

The detection scheme can detect a multi-qubit instead 
of a single-qubit with probabiHty ^. When m > 4, the 
probability amplitude of |0)|ii . . . im-3*m-2*m-i«m) in 
\r]^) and that of \0}\ii . . .im-3im-2im-iim) in \t]1) are 
same or opposite, so the probability of |a) = |0) in the 
\r]^) equals to the probability of \a) = |0) in the \r]l). 



Additionally verifying the cases of m = 2, 3, we can con- 
clude that when measuring the auxiliary qubit, if we gain 
|1) in the \ri'^) with probability a, we must gain |0) in the 
jr^g) with probability 1 — a. So the auxiliary qubit flips 
with probability |. 

Since the detection is a linear operation applied to 
quantum state, it will work not only with pure states, 
but also with mixed states. For example. Bob sends the 
legal state |00) or many copies of |00) to Alice, the mixed 
state inputs the detection. With two auxiliary qubits, 
Alice can detect the case of many copies of |00) with 
probability |. 



VI. CONCLUSION 

In this paper, wc have presented a threshold quantum 
protocol based on two-qubit operation. The number of 
qubits of the generated quantum state by the threshold 
protocol equals to that of the quantum state generated by 
the original (nonthreshold) protocol. Fake signal attack 
strategy and Trojan horse attack strategy of the dishon- 
est participant are investigated. The proposed protocol 
is shown to resist these attacks. 

The proposed two-qubit operation based on Grover's 
algorithm can also be included in QSDC protocols and 
MQSS protocols. The proposed detection scheme of Tro- 
jan horse attack can be included in the other quantum 
cryptography protocols. 
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